I am running Fedora 20, and today I found a file that looks highly suspicious in my home directory. The name of the file appears to be a base64 encoded string, but doesn't decode to anything meaningful:
n5LJFcZz+8slfpALAFzHk8msAh9vsDCiYwKvzw8uAirPE00Jq9HqTSvlT9ChhjZtA==
The contents of the file are here:
Any idea on what I am looking at? I am going to run rkhunter on my machine, is there anything else I should do?
update: The file is owned by my username, which is the only user on this machine:
$ stat n5LJFcZz+8slfpALAFzHk8msAh9vsDCiYwKvzw8uAirPE00Jq9HqTSvlT9ChhjZtA==
File: ‘n5LJFcZz+8slfpALAFzHk8msAh9vsDCiYwKvzw8uAirPE00Jq9HqTSvlT9ChhjZtA==’
Size: 888 Blocks: 8 IO Block: 4096 regular file
Device: fd05h/64773d Inode: 3021277 Links: 1
Access: (0664/-rw-rw-r--) Uid: ( 1000/mvandemar) Gid: ( 1000/mvandemar)
Context: unconfined_u:object_r:user_home_t:s0
Access: 2014-07-23 12:51:37.316782678 -0400
Modify: 2014-05-28 18:25:21.362568805 -0400
Change: 2014-05-28 18:25:21.364568810 -0400
Birth: -
I have no idea what I was doing 2 months ago at that time. lsof
had no output at all. sshd
is not running on my machine (nor do I see any ssh logins via last), although I do see this command via htop:
/usr/bin/ssh-agent /bin/sh -c exec -l /bin/bash -c "cinnamon-session-cinnamon"
Not sure what else I should look for.
history
. Maybe you can spot the responsible command.last
?ls -la
will tell you who the owner is and permissionsbase64
encoded string. You probably tried something withbase64
and forgot about it. How the file got filled with those lines remains a mistery.